Rewind, how that the secret is fixed.

.github/workflows/push-tag.yml

@@ -7,17 +7,21 @@ jobs:
     runs-on: ubuntu-latest
 
     steps:
-      - name: Set up git
-        run: |
-            git config --global user.name "GitHub Actions"
-            git config --global user.email "actions@github.com"
-
-      - name: Clone the datahub repo
-        run: git clone https://github.com/berkeley-dsep-infra/datahub.git
+      - name: Check out the datahub repo
+        uses: actions/checkout@v4
+        with:
+          repository: berkeley-dsep-infra/datahub
+          ref: staging
+          token: ${{ secrets.PUSH_TAG_TOKEN }}
+          path: datahub
 
       - name: Push tag to datahub repo
         run: |
             tag=$(date '+%Y%m%d-%H%M%S')
+
             cd datahub/
+            git config user.name "GitHub Actions"
+            git config user.email "actions@github.com"
+
             git tag ${tag}
-            git push https://x-access-token:${{ secrets.PUSH_TAG_TOKEN }}@github.com/berkeley-dsep-infra/datahub.git ${tag}
+            git push origin ${tag}